KEYPATCH: binary patcher for IDA Pro - PowerPoint PPT Presentation

KEYPATCH: binary patcher for IDA Pro http://keystone-engine.org/keypatch NGUYEN Anh Quynh <aquynh -at- gmail.com> Trada hacking - 16/9/2016 1 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Who am I Nguyen Anh Quynh, aquynh -at- gmail.com ◮ Nanyang Technological University, Singapore ◮ PhD in Computer Science ◮ Operating System, Virtual Machine, Binary analysis, etc ◮ Capstone disassembler: http://capstone-engine.org ◮ Unicorn emulator: http://unicorn-engine.org ◮ Keystone assembler: http://keystone-engine.org 2 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Binary patching CrackMe, CTF challenges Malware analysis Modify binary without source code :-) 3 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

URLZone Banking Trojan 4 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

IDA Pro https://www.hex-rays.com De-facto binary analysis tool Extendable with plugin SDK (C, Python) 5 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Built-in binary patcher of IDA Modify binary code with menu "Edit | Patch program | Assemble..." Save changes permanently to binary file ◮ Menu "Edit | Patch program | Apply patches to input file..." 6 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

How it work? 7 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Problems of IDA built-in binary patcher 8 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch Solution 9 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keystone == Next Generation Assembler Framework 10 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Assembler framework Definition Compile assembly instructions & returns encoding as sequence of bytes ◮ Ex: inc EAX → 40 May support high-level concepts such as macro, function, etc Framework to build apps on top of it Applications Dynamic machine code generation ◮ Binary rewrite ◮ Binary searching 11 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Good assembler framework? True framework ◮ Embedded into tool without resorting to external process Multi-arch ◮ X86, Arm, Arm64, Mips, PowerPC, Sparc, etc Updated ◮ Keep up with latest CPU extensions Multi-platform ◮ *nix, Windows, Android, iOS, etc Bindings ◮ Python, Ruby, Go, NodeJS, etc 12 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Existing assembler frameworks Nothing is up to our standard, even in 2016! ◮ Yasm: X86 only, no longer updated ◮ Intel XED: X86 only, miss many instructions & closed-source ◮ Other important archs: Arm, Arm64, Mips, PPC, Sparc, etc? 13 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Life without assembler frameworks? People are very much struggling for years! ◮ Use existing assembler tool to compile assembly from file ◮ Call linker to link generated object file ◮ Use executable parser (ELF) to parse resulted file for final encoding Ugly and inefficient Little control on the internal process & output Cross-platform support is very poor 14 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

"If not now, then when? If not you, then who?" - Kailash Satyarthi 15 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

16 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Timeline Indiegogo campaign started on March 17th, 2016 (for 3 weeks) ◮ 99 contributors, 4 project sponsors Beta code released to beta testers on April, 2016 ◮ Only Python binding available at this time Version 0.9 released on May, 2016: http://keystone-engine.org ◮ More bindings by beta testers: NodeJS, Ruby, Go & Rust Version 0.9.1 released on July 27th, 2016 ◮ 2 more bindings: Haskell & OCaml 17 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keystone engine True framework ◮ Embedded into tool without resorting to external process Multi-arch ◮ X86, Arm, Arm64, Mips, PowerPC, Sparc, Hexagon, SystemZ Updated ◮ Keep up with latest CPU extensions Multi-platform ◮ *nix, Windows, Android, iOS, etc C++ core & multi-bindings ◮ Python, Ruby, Go, NodeJS, OCaml, Rust, Haskell Support various X86 undocumented instructions Compact & lightweight: 10x smaller than LLVM 18 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch binary patcher for IDA 19 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch Co-developed with Thanh Nguyen (VNSecurity.net) Open source IDA plugin http://keystone-engine.org/keypatch Tool for assembling & patching in IDA Built on top of Keystone assembler framework ◮ Version 1.0 released at BlackHat USA 2016, August 4th, 2016 ◮ Version 2.0 released on September 14th, 2016 ◮ Version 2.0.1 released on September 15th, 2016 20 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch - Patcher 21 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch - Fill Range 22 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch - Assembler 23 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Keypatch vs IDA’s built-in patcher More friendly ◮ Code preview ◮ Padding NOPs automatically ◮ Logging modifications ◮ Fill a range of selected code ◮ Assembler (do not modify) ◮ Revert (undo) Support 8 architectures ◮ Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ, X86 ◮ X86 support is fantastic Open source 24 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Conclusions Keypatch is a superior binary patcher for IDA ◮ Multi-arch + multi-platform ◮ Feature-rich & friendly ◮ Open source Looking for new contributors for our open source projects ◮ Keypatch + Keystone engine ◮ Capstone engine + Unicorn engine 25 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

26 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

References Keypatch: http://keystone-engine.org/keypatch Keystone assembler ◮ Homepage: http://keystone-engine.org ◮ Twitter: @keystone_engine ◮ Github: http://github.com/keystone-engine/keystone ◮ Mailing list: http://freelists.org/list/keystone-engine 27 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro

Questions and answers KEYPATCH: binary patcher for IDA Pro http://keystone-engine.org/keypatch NGUYEN Anh Quynh <aquynh -at- gmail.com> 28 / 28 NGUYEN Anh Quynh KEYPATCH: binary patcher for IDA Pro